Notes on AI agents and MCP
Short, plain notes about building AI agents and MCP servers that work in real businesses: what works, what breaks, and why.
July 1, 2026
Perplexity is walking away from MCP — and they're not wrong
MCP won the standards war so fast that almost nobody stopped to ask whether it's actually good in production. Then Perplexity's CTO said out loud they're moving off it internally — because tool metadata can eat 40–50% of your context window before the agent does a single useful thing. The 'just plug in 50 MCP servers' dream collides with context economics. Tools are a dependency, not a buffet.
- architecture
- agents
- mcp
June 23, 2026
Your MCP servers are a supply chain now
MCP — the protocol that lets agents use tools — took off so fast that security never caught up. Researchers poisoned 9 of 11 public MCP registries with a proof-of-concept package, and an audit of 1,899 MCP servers found about 5% already carrying hidden malicious instructions. If your agent connects to third-party MCP servers, you've added a supply chain — and you need to treat it like one.
- security
- agents
- mcp
June 13, 2026
Your agent's plumbing is wide open
The first large-scale scan of remote MCP servers — the connectors that let AI agents reach your tools and data — found that roughly 40% expose their tools with no authentication at all. Censys counted 12,520 internet-reachable MCP services, most of them unauthenticated. A separate sweep of 40,000 server repos produced 67 new CVEs. The agent boom shipped a new layer of plumbing into production faster than anyone secured it, and right now a lot of it is unlocked. Here's the risk in plain terms and what to check today.
- security
- agents
- mcp
June 6, 2026
12,520 agent tools are on the internet with no lock on the door
Security researchers scanned the internet and found 12,520 MCP servers — the tool connectors that let AI agents do real things — sitting in the open, most with no authentication at all. Some let any stranger run database queries or shell commands. The protocol just made auth mandatory in its June spec, but the damage shows the deeper bug: the default was 'no lock,' and people shipped the default. If your agent can reach a tool, so can everyone else — unless you decided otherwise on purpose.
- security
- architecture
- agents
- mcp